A Comparison of Quantum Oracles 
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A standard quantum oracle Sf for a general function / ; Zn Zn is defined to act on two 
input states and return two outputs, with inputs \i) and |j) G Zn) returning outputs |j) and 
\j © f{i))- However, if / is known to be a one-to-one function, a simpler oracle, Mf, which returns 
\f{i)) given can also be defined. We consider the relative strengths of these oracles. We define a 
simple promise problem which minimal quantum oracles can solve exponentially faster than classical 
oracles, via an algorithm which cannot be naively adapted to standard quantum oracles. We show 
that Sf can be constructed by invoking Mf and (Af/)~^ once each, while Q{-\/N) invocations of 5/ 
and/or (5*/)"^ are required to construct Mf. 



Recent years have witnessed an explosion of interest in 
quantum computation, as it becomes clearer that quan- 
tum algorithms are more efficient than any known classi- 
cal algorithm for a variety of tasks. One important 
way of comparing the efficiencies is by analysing query 
complexity, which measures the number of invocations 
of an "oracle" — which may be a standard circuit im- 
plementing a useful sub-routine, a physical device, or 
a purely theoretical construct — needed to complete a 
task. A number of general results show the limitations 
and advantages of quantum computers using the query 
complexity models 

In this paper we compare the query complexity anal- 
ysis of quantum algorithms given two different ways of 
representing a permutation in terms of a black box quan- 
tum oracle. We begin with a short discussion of graph 
isomorphism problems, which motivates the rest of the 
paper. 

Suppose we are given two graphs, Gi = {Vi,Ei) and 
G2 = {V2,i?2), represented as sets of vertices and edges 
in some standard notation. The graph isomorphism (GI) 
problem is to determine whether Gi and G2 are isomor- 
phic: that is, whether there is a bijection j V\ ^ Vi 
such that (/(w),/(u)) e E2 if and only if (u,w) G E^. 
(We assume \yi \ = IV2I, else the problem is trivial.) GI is 
a problem which is NP but not known to be NP-complete 
for classical computers, and for which no polynomial time 
quantum algorithm is currently known. 

We are interested in a restricted version (NAGI) of GI, 
in which it is given that G\ and Gi are non-automorphic: 
i.e., they have no non-trivial automorphisms. So far as 
we are aware, no polynomial time classical or quantum 
algorithms are known for NAGI either. The following ob- 
servations suggest a possible line of attack in the quan- 
tum case. 

First, for any non-automorphic graph G = iy,E), 
we can define a unitary map Mq that takes permuta- 
tions p of F as inputs and outputs the permuted graph 
p{G) = (p(F), p(i?)), with some standard ordering (e.g. 
alphabetical) of the vertices and edges, in some standard 
computational basis representations. That is, writing 



\V\ = iV, for any p £ Sjq-, Mq maps \p) to \p{G)). Con- 
sider a pair (Gx^G-i) of non-automorphic graphs. Given 
circuits implementing Mq^, Mq^, we could input copies 
of the state SpeSw ^° ^^'^^ circuit, and com- 
pare the outputs = ^Ep6S« l/'(GO>- Now, if 
the graphs are isomorphic, these outputs are equal; if 
not, they are orthogonal. These two cases can be distin- 
guished with arbitrarily high confidence in polynomial 
time (see below), so this would solve the problem. 

Unfortunately, our algorithm for NAGI requires con- 
structing circuits for the Mc. , which could be at least as 
hard as solving the original problem. On the other hand, 
it is easy to devise a circuit, Sg, which takes two inputs, 
\p) and a blank set of states |0), and outputs \p) and 
\p{G)). Since Sg and Mg implement apparently simi- 
lar tasks, one might hope to find a way of constructing 
Mq from a network involving a small number of copies 
of Sg- Such a construction would solve NAGI. Alter- 
natively, one might hope to prove such a construction 
is impossible, and so definitively close off this particular 
line of attack. 

Thus motivated, we translate this into an abstract 
problem in query complexity. 

Consider the following oracles, defined for a general 
function / : {0, 1}"* ^ {0, 1}": 

• the standard oracle, Sf : \x)\h) — > |a:)|5 fix))- 



• the Fourier phase oracle, Pf 



\x)\b) 



Here x and b are strings of m and n bits respectively, rep- 
resented as numbers modulo M = 2"* and N = 2^ , \x) 
and 1 6) are the corresponding computational basis states, 
and ® is addition modulo 2". 

Note that the oracles Pf and Sf are equivalent, in the 
sense that each can be constructed by an /-independent 
quantum circuit containing just one copy of the other, 
and also equivalent to their inverses. To see this, de- 
fine the quantum Fourier transform operation F and the 
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parity reflection i? = by 



After controlled swap gates, the state becomes: 



^ ■ 1^') ^ E exp(27rzjfc/7V)|fc) , R : \j) 



Then we have 
in 



F)oSfo{I(g)F-^) = Pf, 
F-^)oPfo{I(g,F)^Sf, 
(Kg) R)o Sfo (Kg) R) ^ {Sfy\ 
(Kg) R) o Pf o (Kg, R) ^ (P^)-i . 

For the rest of the paper we take m = n and suppose 
we know / is a permutation on the set {0, 1}". There is 
then a simpler invertible quantum map associated to /: 



the minimal oracle: M 



f 



We can model NAGI, and illustrate the different be- 
haviour of standard and minimal oracles, by a promise 
problem. Suppose we are given two permutations, a and 
/3, of Zjsf, and a subset 5* of Zpf, and are promised that 
the images a{S) and P{S) are either identical or disjoint. 
The problem is to determine which. (This problem has 
been considered in a different context by Buhrman et al 

We represent elements x € Zjv by computational ba- 
sis states of n qubits in the standard way, and write 

Figure 1 gives a quantum network with minimal or- 
acles that identifies disjoint images with probability at 
least 1/2. 
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FIG. 1. A quantum circuit for the permutation promise 
problem. Oa and are minimal oracles for computing the 
permutations a and /3 respectively, \S) is the superposition of 
all the basis states, H is the Hadamard transformation, and 
all the other gates are conditional swap gates, where circles 
signify control bits. 

Let A = {a{x)\x G S} and B = {f3{x)\x G S}. One 
query to the oracles Ma and creates the (unnor- 
malised) states \A) and \B) respectively. The state before 
applying the controlled gates is: 

\A)\B) ^i\0)-\l)) 



\A)\B)\0)-\B)\A)\1). 
The final Hadamard gate on the ancilla qubit gives: 

i\A)\B)-\B)\Am + {\A)\B) + \B)\A))\l) 

A |0) outcome shows unambiguously that the images 
are disjoint. A |1) outcome is generated with probability 
1 if the images are identical, and with probability 1/2 if 
the images are disjoint. Repeating the computation K 
times allows one to exponentially improve the confidence 
of the result. If after K trials we get |0) at least once, 
we know for certain that a{S) ^ P{S). When all the K 
outcomes were |1), the conclusion that a{S) = P{S) has 
the conditional probability pfc = oi having been er- 
roneously generated by disjoint input images. Note that 
Pk is independent of the problem size and decreases ex- 
ponentially with the number of repetitions. 

Clearly, a naive adaptation of the algorithm to stan- 
dard oracles does not work. Replacing Ma and Mp by 
Sa and S/s, and replacing the inputs by jS*) (g) |0), results 
in output states which are orthogonal if the images are 
disjoint, but also in general very nearly orthogonal if the 
images are identical. Applying a symmetric projection as 
above thus almost always fails to distinguish the cases. 
To the best of our knowledge a non-trivial lower bound 
for this problem using the Sf is not known (however, see 

@). , 

This example suggests that minimal oracles may be 
rather more powerful than standard oracles. To estab- 
lish a more precise version of this hypothesis, we exam- 
ine how good each oracle is at simulating the other. One 
way round turns out to be simple. We can construct Sf 
from Mf and (Mf)^^ — Mf-i as follows: 

Sf = (Mf-i g)I)oAo {Mf g) I) 

where o represents the composition of operations (or the 
concatenation of networks) and the modulo N adder A 
is defined by A : \a) g) \b) \a) (g\a(Bb). 

Suppose that we are given Mf in the form of a speci- 
fied complicated quantum circuit. We may be completely 
unable to simplify the circuit or deduce a simpler form 
of / from it. However, by reversing the circuit gate by 
gate, we can construct a circuit for {Mf)'^. Hence, by 
the above construction, we can produce a circuit for Sf, 
using one copy and one reversed copy of the circuit for 
Mf. 

This way of looking at oracles can be formalised into 
the circuit model, in which the query complexity of an al- 
gorithm involving an oracle Of associated to a function 
/ is the number of copies of 0/ and/or OJ^ required 
to implement the algorithm in a circuit that, apart from 
the oracles, is independent of /. In the circuit model, a 
standard oracle can easily be simulated given a minimal 
oracle. Ignoring constant factors, we say that the mini- 
mal oracle is at least as strong as the standard oracle. 
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It should be stressed that, while the chcuit model has 
a natural justification, there are other interesting ora- 
cle models, to which our arguments will not apply. For 
example, if we think of the oracle Mf as a black box 
supplied by a third party, then we should not assume 
that (Mf)^^ can easily be constructed from Mf, as we 
know no way of efficiently reversing the operation of an 
unknown physical evolution. 

Remaining within the circuit model, we now show that 
Mf and 5/ are not (even up to constant factors) equiva- 
lent. In fact, simulating Alf requires exponentially many 
uses oi Sf. 

First, consider the standard oracle S f-i which maps a 
basis state \y)\b) to \y)\b(B f-^{y)). Since Sf-i : \y)\0) 
\y)\f~^{y)), simulating it allows us to solve the search 
problem of identifying |/^^(?;)) from a database of N 
elements. It is known that, using Grover's search algo- 
rithm, one can simulate Sf-i with 0{^/N) invocations of 
Sf [ [lO|jllf| . In the following we explain one possible way 
of doing that. 

Prepare the state ly) |0) |0) |0), where the first three reg- 
isters consist of n qubits and the last register is a single 
qubit. Apply Hadamard transformations on the second 
register to get = \y)J2xGZN l^)|0)|0)- Invoking Sf 
on the second and third registers now gives 

|y>(E l^)l/(^)))|o)- 

Using CNOT gates, compare the first and third registers 
and put the result in the fourth, obtaining 

J2 l^)l/(^))|0)) + (|y)|r^(2;))|y)|l)). 

Now apply {Sf )~^ on the second and third registers, ob- 
taining 

(|y) J2 l^)|0)|0)) + (|y)|ri(y))|0)|l)). 

Taken together, these operations leave the first and third 
registers unchanged, while their action on the second and 
fourth defines an oracle for the search problem. Applying 
Grover's algorithm [|j to this oracle, we obtain the state 
\y)\f~^{y)) after 0{^/N) invocations. 

Lemma 1 To simulate the inverse oracle "S^-i 
with a quantum network using oracles Sf and {Sf)~ , a 
total number of Q{y/N) invocations of Sf are necessary. 

Proof The upper bound of 0{\/N) is implied by the 
Grover-based algorithm just discussed. Ambainis 
has shown that Q{^/N) invocations of the standard or- 
acle Sf are required to invert a general permutation /. 
QED. 

Given Sf and S f-i, Bennett has shown how to simulate 
M f within classical reversible computation . Using a 
quantum version of this construction, we can establish 
our main result: 



Lemma 2 To simulate the minimal oracle Mf 
with a quantum network using oracles Sf and {Sf)~^, a 
total number of 0(-\/]V) invocations of 5*/ are necessary. 

Proof Given Sf and Sf-i, we can simulate Mf as 
follows: 

Mf(g)I={Sf-i)-^oXoSf, 

where the swap gate X is defined hy X : |a) (g) 
|5)(8)|a). From Lemma 1, Sf-i needs 9(\/]V) invocations 
of Sf and {Sf)~^. Therefore we get the upper bound of 
0{VN) for simulation of Mf. 

However this is the optimal simulation. For suppose 
there is a network which simulates Mf with less than 
fl{^/N) queries. The reversed network simulates Mf-i. 
From these two, by our earlier results, we can construct 
a network that simulates Sf-i with fewer than Q{-\/N) 
queries, which contradicts Lemma 1. QED. 

It is worth remarking that we could equally well have 
carried through our discussion using variants oi Sf and 
Pf, such as the bitwise acting versions: 

• the bit string standard oracle, S"^'* : |x)|b) —> 
|x)|b®f(x)). 

• the bit string phase oracle, P^"* : |x)|b) 

g2^»f(x).b/2|^^|b). 

Here b x denotes the bitwise sum mod 2 of the strings 
b and x, and b • x their inner product mod 2. Again, 
Sy^ and Pj?'* are equivalent: writing 

for the tensor product of n Hadamard operators acting 
on register qubits, we have 

(/ (g J^) o Sf o{I(E) jc-i) = P]?'t , 
(/ (g> T-^) o pf' o{I®T)^ sf . 

Note also that Sf = [SfY^, Pf* = {Pf*)-'^. Our 
results still apply: S"^'* has essentially the same relation 
to Mf that Sf does. 

In summary, constructing a minimal oracle requires ex- 
ponentially many invocations of a standard oracle. We 
can thus indeed definitively exclude the possibility of effi- 
ciently solving NAGI by simulating Mf using Sf, which 
motivated our discussion. We have not, however, been 
able to exclude the possibility of directly constructing a 
polynomial size network defining an Mf oracle for any 
given 1 — 1 function /, which would lead to a polynomial 
time solution of NAGI. 
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